PHP MySQL prepared statements

Prepared statements are very useful to prevent MySQL injection.

Preprocessed statements and bound parameters

Preprocessed statements are used to execute multiple identical SQL statements with higher execution efficiency.

The working principle of prepared statements is as follows:

1. Preprocessing: Create a SQL statement template and send it to the database. Reserved values ​​are marked with the parameter "?". For example:

INSERT INTO MyGuests (firstname, lastname, email) VALUES(?, ?, ?)

2. Database parsing, compilation, query optimization on SQL statement templates, and storage of results No output.

3. Execution: Finally, the application-bound value is passed to the parameter ("?" mark), and the database executes the statement. The application can execute the statement multiple times if the parameter values ​​are different.

Compared with directly executing SQL statements, prepared statements have two main advantages:

1) Prepared statements greatly reduce analysis time and only make one query (although the statements are multiple times implement).

2) Binding parameters reduces server bandwidth, you only need to send the parameters of the query instead of the entire statement.

Preprocessed statements are very useful for SQL injection, because different protocols are used after the parameter values ​​are sent, ensuring the legality of the data.

MySQLi prepared statements

The following examples use prepared statements in MySQLi and bind the corresponding parameters:

Example (MySQLi uses prepared statements)

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";
// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);
// 检测连接
if ($conn->connect_error){
    die("连接失败: " . $conn->connect_error);
}
// 预处理及绑定
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES(?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);
// 设置参数并执行
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();
$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";
$stmt->execute();
$firstname = "Julie";
$lastname = "Dooley";
$email = "julie@example.com";
$stmt->execute();
echo "新记录插入成功";
$stmt->close();
$conn->close();
?>

Parse each line of code for the following example:

"INSERT INTO MyGuests (firstname, lastname, email) VALUES(?, ?, ?)"

In the SQL statement, we use the question mark (?), here we can replace the question mark with Integers, strings, doubles, and booleans.

Next, let’s take a look at the bind_param() function:

$stmt->bind_param("sss", $firstname, $lastname, $email);

This function binds SQL parameters and tells the database the value of the parameters. The "sss" parameter column handles the data types of the remaining parameters. The s character tells the database that the parameter is a string.

The parameters have the following four types:

i - integer (integer type)

d - double (double precision floating point type)

s - string (string)

b - BLOB (binary large object: binary large object)

Each parameter needs to specify the type.

By telling the database the data type of the parameter, you can reduce the risk of SQL injection.

Note: If you want to insert other data (user input), validation of the data is very important.

Prepared statements in PDO

In the following examples, we use prepared statements and bind parameters in PDO:

Example (PDO using prepared statements)

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDBPDO";
try {
    $conn = new PDO("mysql:host=$servername; dbname=$dbname", $username, $password);
    // 设置 PDO 错误模式为异常
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    // 预处理 SQL 并绑定参数
    $stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email)
    VALUES (:firstname, :lastname, :email)");
    $stmt->bindParam(':firstname', $firstname);
    $stmt->bindParam(':lastname', $lastname);
    $stmt->bindParam(':email', $email);
    // 插入行
    $firstname ="John";
    $lastname = "Doe";
    $email = "john@example.com";
    $stmt->execute();
    // 插入其他行
    $firstname = "Mary";
    $lastname = "Moe";
    $email = "mary@example.com";
    $stmt->execute();
    // 插入其他行
    $firstname = "Julie";
    $lastname = "Dooley";
    $email = "julie@example.com";
    $stmt->execute();
    echo "新记录插入成功";
}
catch(PDOException $e)
{
    echo $sql . "<br>" . $e->getMessage();
}
$conn = null;
?>